CVE-2025-23318 is a high severity (CVSS 8.1) out-of-bounds write in the Python backend of NVIDIA Triton Inference Server for Windows and Linux. It may lead to code execution, denial of service, data tampering and information disclosure. NVIDIA lists versions prior to 25.07 as affected.
What's affected
NVIDIA's August 2025 security bulletin for Triton Inference Server, released on 6 August 2025, lists Windows and Linux with a different fixed release depending on the CVE. For this one, all versions prior to 25.07 are affected and 25.07 is the updated version. The vector shows network access with high attack complexity, which lowers the score from the critical range. NVIDIA credits Trend Micro's Zero Day Initiative users for this report.
The same bulletin lists many other Triton CVEs fixed in releases 25.05, 25.06 and 25.07, so a server older than 25.07 is exposed to several issues at once. The bulletin's notes advise production users to follow the Secure Deployment Considerations Guide.
How to check if you're exposed
Find the Triton release you run. Most deployments use NVIDIA's container images, which carry a YY.MM tag.
docker images | grep -i tritonserver
tritonserver --version
Compare the result with the fixed release for your CVE. Then look at how the server is exposed. The bulletin's notes say production users should follow the Secure Deployment Considerations Guide and make sure logging and shared memory APIs are protected for use by authorized users. Check which networks can reach the HTTP and gRPC ports, and whether those management style APIs are open to anyone.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade Triton Inference Server to 25.07 or later, using the release on the Triton GitHub releases page.
- Rebuild and redeploy any container image that pins an older tag.
- Follow NVIDIA's Secure Deployment Considerations Guide, and make sure logging and shared memory APIs are limited to authorized users.
- Keep the inference ports on a private network or behind an authenticated gateway.
- Review other Triton CVEs in the same bulletin so one upgrade covers them all.
Why it matters
CWE-787 is an out-of-bounds write and CWE-805 is buffer access with an incorrect length value. In the Python backend, data moves between the main server process and a Python process through shared memory. A wrong length lets a write land outside the buffer it was meant for.
Memory safety bugs like this one are classic for native code that sits behind a language runtime. The NVIDIA description is brief and does not detail the trigger. The score reflects high attack complexity, so it is harder to use than the critical HTTP issue in the same bulletin. It is fixed by the same 25.07 release. The KEV flag is false.
Quick check
Which releases are affected?
Versions prior to 25.07 on Windows and Linux, according to NVIDIA's August 2025 bulletin.
Is the Python backend always in use?
The bulletin does not say which deployments are exposed. Check whether your models use the Python backend, and upgrade regardless since one release fixes several issues.
Sources
Last reviewed: 19 October 2026.
